NetSight
IP …
medium6.5Public exploit code

CVE-2012-5612

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticat…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated using certain variations of the (1) USE, (2) SHOW TABLES, (3) DESCRIBE, (4) SHOW FIELDS FROM, (5) SHOW COLUMNS FROM, (6) SHOW INDEX FROM, (7) CREATE TABLE, (8) DROP TABLE, (9) ALTER TABLE, (10) DELETE FROM, (11) UPDATE, and (12) SET PASSWORD commands.

Affected products

VendorProductAffected versions
MariadbMariadb
from 5.1.0 before 5.1.67
from 5.2.0 before 5.2.14
from 5.3.0 before 5.3.12
from 5.5.0 before 5.5.29
Version 10.0.0
OracleMysql
from 5.5.0 through 5.5.28
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise Server
Version 11
SuseLinux Enterprise Software Development Kit
Version 11
CanonicalUbuntu Linux
Versions 10.04, 11.10, 12.04, 12.10

Weakness classification

CWE-787

References